How to fix an expired or untrusted SSL certificate

Your site loads fine one day, then suddenly visitors see a scary browser warning instead of your page.

Short version: to fix an expired or untrusted SSL certificate, renew or replace the certificate for the exact domain people are visiting, make sure the domain points to the right server, and reload the web service that serves HTTPS. If the browser says NET::ERR_CERT_DATE_INVALID, the certificate is usually expired or not valid yet; if it says NET::ERR_CERT_AUTHORITY_INVALID, the certificate is usually self-signed, issued by the wrong authority, or missing part of its trust chain.

What does “SSL certificate expired” or “certificate not trusted” mean?

An SSL certificate is like an ID card for your website. It tells the browser, “yes, this server is allowed to speak for this domain, and the connection can be encrypted.”

When the certificate is expired, the ID card is out of date. Browsers may show messages like Your connection is not private, NET::ERR_CERT_DATE_INVALID, or SSL certificate expired.

When the certificate is untrusted, the browser does not believe the ID card was issued by a recognized authority, or it cannot connect the dots from your certificate back to one. You may see NET::ERR_CERT_AUTHORITY_INVALID, certificate not trusted, or a warning that the issuer is unknown.

The important point: this is not just cosmetic. Many visitors will leave, forms may stop working, APIs may reject requests, and payment or login flows can fail.

Why did your SSL certificate expire or become untrusted?

Most HTTPS certificates have an expiry date. Free certificates from Let’s Encrypt, for example, are intentionally short-lived and must renew regularly. That is normal; the problem is when renewal silently breaks.

Common causes include:

• The renewal tool was never set up, or stopped running.
• The domain no longer points to the same server.
• A firewall blocks the check that proves you control the domain.
• The certificate was issued for example.com, but visitors are using www.example.com.
• The server is still serving an old certificate after a new one was created.
• The certificate chain is incomplete, so browsers cannot verify the issuer.
• The server clock is wrong, making a valid certificate look “not valid yet” or expired.

Think of it like a shop changing its street address but forgetting to update the delivery company. The certificate renewal may be working in one place, but the browser is knocking on a different door.

If you recently moved a domain, start with the basics in pointing a domain at your server. If you host several sites together, wrong-site certificates are especially easy to create; we cover that bigger picture in hosting multiple websites on one server.

How do you fix an expired SSL certificate?

Start by checking the exact domain in the browser warning. example.com and www.example.com are different names. So are app.example.com and api.example.com. The certificate must cover the name your visitor actually typed or clicked.

Next, confirm the domain points to the correct server. If the domain points somewhere old, renewing the certificate on the new server will not help. The browser is still talking to the wrong machine.

Then renew or replace the certificate for that exact domain. If you use a certificate authority such as Let’s Encrypt, the server must be able to prove control of the domain during renewal. That proof can fail when web traffic is routed incorrectly, a firewall blocks the request, or another app is answering before the renewal tool gets its turn.

After the certificate is renewed, make sure the web server is actually using the new one. This is the part people miss: creating a fresh certificate is like printing a new ID card, but your doorman may still be holding the old one. The HTTPS service needs to pick up the renewed certificate.

Finally, test from outside your own browser. Browser cache can make certificate problems look confusing. A private window, another device, or an online SSL checker can tell you what the public internet sees.

If you are setting this up for the first time, our free HTTPS guide explains the pieces without assuming you already speak web-server language.

FAQ

**What does NET::ERR_CERT_DATE_INVALID mean?** It usually means the certificate is expired, not valid yet, or your server’s clock is wrong.

**What does NET::ERR_CERT_AUTHORITY_INVALID mean?** It means the browser does not trust the organization that issued the certificate, or the certificate chain is incomplete.

Can I ignore an expired SSL certificate warning? Not for a public site. Visitors will see a security warning, and some browsers, apps, or payment tools may refuse to connect.

Do I need a separate certificate for every subdomain? Each hostname must be covered. That can mean separate certificates, one certificate with several names, or a wildcard certificate.

Why does my certificate look renewed but the browser still complains? The server may still be serving the old certificate, or your domain may be pointing to a different server than the one you fixed.

The shortcut

Server Manager helps by keeping the HTTPS setup tied to the site people are actually visiting. That means fewer mistakes like renewing example.com while www.example.com is still broken, or fixing the right certificate on the wrong server.

It also keeps the setup legible over time. Months later, you can still understand which domain belongs to which site, where HTTPS is expected to work, and what changed. The real benefit is not having to rebuild the whole story during an outage.

For the problems in this post, that means fewer expired certificates, fewer wrong-domain certificates, fewer “why is this browser still showing the old one?” moments, and a clearer path back to a working green lock.

What does “fixed” look like?

A fixed SSL certificate problem is boring in the best way. The browser opens your site without Your connection is not private, the certificate details show the correct domain, the expiry date is in the future, and the issuer is trusted.

You do not need to become a certificate expert. You just need the right domain pointing to the right server, a valid certificate covering that name, and a setup you can still understand the next time something changes.